Some interesting data about EDR effectiveness that may cause some controversy … 🙂 …
A key aspect of a NodeZero pentest is deploying a Remote Access Tool (RAT) onto hosts that NodeZero compromises. RATs play a key role in post-exploitation, including:
1. Enabling persistence by initially existing in memory but finding ways to survive a reboot
2. Privilege Escalation by exploiting vulnerabilities and misconfigurations local to the host the RAT has compromised
3. Credential Harvesting by extracting credentials and authentication tokens from other running processes and files local to that machine
So basically, if an attacker can deploy a RAT onto a host, it’s really bad. That’s why organizations spend millions of dollars on EDRs… and the primary job of an EDR is to prevent RAT’s from deploying onto hosts, but at the very least an EDR needs to quickly detect, contain, and eradicate the RAT to minimize damage
Over the past year NodeZero has run 60,000 pentests globally. RAT’s have been deployed onto windows and linux boxes in many of those pentests, and we’ve come across a dozen different EDR vendors that have (or should have) prevented, detected, and stopped the RAT
So what does the data tell us? It says we have a pretty serious EDR Effectiveness problem. If you’re a vendor, don’t get mad at me, I’m purely a vessel for the data
For the data below, the NodeZero RAT was autonomously (and nefariously) installed on a host during the course of a pentest, the RAT then successfully dumped LSA, LSASS, SAM, DPAPI, and other sensitive Windows processes, and the EDR did nothing to detect, contain, or eradicate the RAT
Keeping in mind that our RAT does NOT do any sort of EDR evasion, it’s literally a bonfire in a public square, we found the following EDR effectiveness rates for EDR’s deployed on Windows hosts…
1. Checkpoint successfully detected, contained, and eradicated our RAT ~2% of the time (!!)
2. To my surprise, Crowdstrike was only successfully 16% of the time whereas SentinelOne was successful 74% of the time. Often ineffectiveness is due to how the EDR was configured, but that’s not an excuse during a breach post-mortem
3. Palo Alto Cortex and Sophos (?!) were the most effective at 77% and 80% respectively
Even in the best case, 20% defeat rate is pretty bad given how much money and faith we have in our EDR tools. Which iterates the importance of defense in depth and verifying the effectiveness of your detection and response stack
The team is crunching data for RATs deployed onto Linux hosts, and we’re working on some really cool features to help improve the effectiveness of your EDR
ducking for cover…wish me luck